Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About alferone
alferone
Explorer
Member since:
11-13-2023
09-17-2025
Community Statistics
| Posts | 16 |
| Solutions | 0 |
| Karma Given | 3 |
| Karma Received | 0 |
| Member Since | 11-13-2023 |
Activity Feed
- Posted Re: Links to Load Panels are Garbled - How to Put Links in One Line? on Dashboards & Visualizations. 04-25-2025 05:32 AM
- Posted Links to Load Panels are Garbled - How to Put Links in One Line? on Dashboards & Visualizations. 04-24-2025 06:40 AM
- Posted Re: Problem with timestamp extraction and props.conf on Getting Data In. 10-30-2024 01:22 PM
- Posted Problem with timestamp extraction and props.conf on Getting Data In. 10-30-2024 09:54 AM
- Posted Re: Count X's in each field in a table and total them in the last column on Splunk Search. 10-01-2024 08:58 AM
- Posted Count X's in each field in a table and total them in the last column on Splunk Search. 10-01-2024 08:28 AM
- Karma Re: Basic KV Store Question - Updating Thousands of Records at Once for gcusello. 09-16-2024 08:08 AM
- Karma Re: Basic KV Store Question - Updating Thousands of Records at Once for gcusello. 09-16-2024 08:07 AM
- Posted Re: Basic KV Store Question - Updating Thousands of Records at Once on Splunk Search. 09-12-2024 07:10 AM
- Posted Re: Basic KV Store Question - Updating Thousands of Records at Once on Splunk Search. 09-11-2024 06:03 AM
- Posted Re: Basic KV Store Question - Updating Thousands of Records at Once on Splunk Search. 09-11-2024 05:58 AM
- Posted Basic KV Store Question - Updating Thousands of Records at Once on Splunk Search. 09-11-2024 05:28 AM
- Posted Re: Corrupt csv header in CSV file , 2 columns with the same name ' on Splunk Enterprise. 08-30-2024 08:32 AM
- Posted Re: Change time format for a workflow action? on Splunk Enterprise. 12-14-2023 05:42 AM
- Posted Change time format for a workflow action? on Splunk Enterprise. 12-12-2023 11:36 AM
- Posted Re: Using a Lookup with wildcard to check on logging status on Splunk Search. 11-13-2023 08:00 AM
- Karma Re: Using a Lookup with wildcard to check on logging status for ITWhisperer. 11-13-2023 08:00 AM
- Posted Re: Using a Lookup with wildcard to check on logging status on Splunk Search. 11-13-2023 06:55 AM
- Posted Using a Lookup with wildcard to check on logging status on Splunk Search. 11-13-2023 06:46 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 | |||
| 0 |
04-25-2025
05:32 AM
<row>
<panel>
<input type="link" token="needed">
<label>Show missing hosts from:</label>
<choice value="link1">Splunk</choice>
<choice value="link2">Tanium</choice>
<choice value="link3">Tenable</choice>
<choice value="link4">Forescout</choice>
<choice value="link5">Fireeye</choice>
<choice value="link6">SCCM</choice>
<choice value="link7">SentinelOne</choice>
<choice value="link8">Multiple Tools (3 or more)</choice>
<default>Multiple Tools (3 or more)</default>
<change>
<condition value="link1">
<set token="show_splunk">true</set>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link2">
<unset token="show_splunk"></unset>
<set token="show_tanium"></set>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link3">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<set token="show_tenable"></set>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link4">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<set token="show_forescout"></set>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link5">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<set token="show_fireeye"></set>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link6">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<set token="show_sccm"></set>
<unset token="show_sentinelone"></unset>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link7">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<set token="show_sentinelone"></set>
<unset token="show_multiple3"></unset>
</condition>
<condition value="link8">
<unset token="show_splunk"></unset>
<unset token="show_tanium"></unset>
<unset token="show_tenable"></unset>
<unset token="show_forescout"></unset>
<unset token="show_fireeye"></unset>
<unset token="show_sccm"></unset>
<unset token="show_sentinelone"></unset>
<set token="show_multiple3"></set>
</condition>
</change>
</input>
<table depends="$show_splunk$">
<title>Splunk Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname Splunk_LastSeen
| where Splunk_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_tanium$">
<title>Tanium Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname Tanium_LastSeen
| where Tanium_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_tenable$">
<title>Tenable Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname Tenable_LastSeen
| where Tenable_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_forescout$">
<title>Forescout Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname Forescout_LastSeen
| where Forescout_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_fireeye$">
<title>Fireeye Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname FireEye_LastSeen
| where FireEye_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_sccm$">
<title>SCCM Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname Sccm_LastSeen
| where Sccm_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_sentinelone$">
<title>SentinelOne Missing Hosts</title>
<search base="asset_explorer">
<query>| table hostname SentinelOne_LastSeen
| where SentinelOne_LastSeen = "X"</query>
</search>
<option name="drilldown">none</option>
</table>
<table depends="$show_multiple3$">
<title>3 Tools or More Missing</title>
<search base="asset_explorer">
<query>| where Missing_Tools >= 3 | table hostname Splunk_LastSeen Tanium_LastSeen Tenable_LastSeen Forescout_LastSeen FireEye_LastSeen Sccm_LastSeen Missing_Tools | sort 0 -Missing_Tools +hostname</query>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row> Thanks!
... View more
04-24-2025
06:40 AM
Hello all, I have a dashboard that utilizes a dynamic panel for loading different tables depending on which link is clicked. However, the links are all garbled. The first 4 display, but the others are underneath the dynamic panel. If you right arrow after clicking one of the links, you can get to each link, but the display is all messed up. How do I get all of the links into one single line? Thanks!
... View more
Labels
- Labels:
-
Classic dashboard
-
CSS
-
panel
10-30-2024
01:22 PM
I'll take a look, and thank you!
... View more
10-30-2024
09:54 AM
I have the following props which works fine in the "Add Data" GUI and a test file of logs: EVENT_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s
EVENT_BREAKER_ENABLE = true
LINE_BREAKER = ([\r\n]+)\<.+\>\w{2,4}\s\d{1,2}\s
MAX_TIMESTAMP_LOOKAHEAD = 25
SHOULD_LINEMERGE = false
TIME_FORMAT = %d-%b-%Y %H:%M:%S.%3N
TIME_PREFIX = named\[.+\]\:\s
TRUNCATE = 99999
TZ = US/Eastern I am trying to pull milliseconds from the log using the 2nd timestamp. <30>Oct 30 11:31:39 172.1.1.1 named[18422]: 30-Oct-2024 11:31:39.731 client 1.1.1.1#1111: view 10: UDP: query: 27b9eb69be0574d621235140cd164f.test.com IN A response: NOERROR +EDV 27b9eb69be0236356140cd164f.test.com. 30 IN CNAME waw-test.net.; waw-mvp.test.net. 10 IN A 41.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1; test.net. 10 IN A 1.1.1.1; I have this loaded on the indexers and search heads. But it is still pulling from the first timestamp. A btool on the indexers shows this line that I have not configured.: DATETIME_CONFIG = /etc/datetime.xml Is this what is screwing me up? Thank you!
... View more
Labels
- Labels:
-
props.conf
10-01-2024
08:58 AM
Thank you for the response! So, I tried it, and it isn't working, but for more context: I run a stats command for the table, and after that, I run a fillnull to insert the X's into the table. I tried another stats after that, but that didn't work. How would I append the "Total_X's" field to the table?
... View more
10-01-2024
08:28 AM
Hello everyone, I have a table (generated from stats) that has several columns, and some values of those columns have "X's". I would like to count those X's and total them in the last column of the table. How would I go about doing that? Here is an example table, and thank you! Field1 | Field2 | Field3 | Field4 | Field5 | Total_Xs
X | X | Foo | Bar | X | 3
Foo2 | X | Foo | Bar | X | 2
X | X | X | Bar | X | 4
... View more
09-12-2024
07:10 AM
So just to be clear, this would not be a candidate for KV Store?
... View more
09-11-2024
06:03 AM
I'll give it a shot. Thank you for your help!
... View more
09-11-2024
05:58 AM
I was considering that initially. Would the search be a little taxing to pull all of the different tools and times together?
... View more
09-11-2024
05:28 AM
Hello all, I have a requirement to list all of our assets and show the last time they appeared in the logs of many different tools. I wanted to use KV store for this. We would run a search against each tool's logs and then update it's "last seen" time in the KV store for the particular asset. I've attempted this a few ways, but I can't see to get it going. I have the KV Store built with one column of last_seen times for one tool. But I am lost on how to update last_seen times for other tools for existing entries in the KV Store. Any guidance would be appreciated. Thank you!
... View more
Labels
- Labels:
-
lookup
08-30-2024
08:32 AM
I've never understood why Spunk doesn't just log the offending .csv file.
... View more
12-14-2023
05:42 AM
Well, yeah, I understand how I can convert the time from epoch, but I am trying to do this inside of a workflow action. Someone searches "index=firewall", and then they click on "Event Actions" to click on the workflow action. How does the time get converted through that mechanism?
... View more
12-12-2023
11:36 AM
Here is a snippet of the URL I am sending and the time format in which it needs to be: startTime=2023-12-01T16%3A27%3A45.000Z&endTime=2023-12-01T16%3A32%3A45.000Z However, when I try to send "latesttime" or "earliesttime", splunk is sending it in epoch. How do I get the proper format of time for the URL within the workflow action? Thanks!
... View more
Labels
- Labels:
-
using Splunk Enterprise
11-13-2023
08:00 AM
Understood. Thanks again!
... View more
11-13-2023
06:55 AM
My goodness. That is exactly what I am looking for. I should've known that! I was definitely over complicating it. THANK YOU!! How would I be able to list the files in the lookup that are NOT logging?
... View more
11-13-2023
06:46 AM
Hello all, I have a lookup with a single column that lists source file names and paths. I want to search an index and lookup the sources, then show the latest time of those sources. I also want to show if a file hasn't logged at all in a given timeframe. I set the lookup to use WILDCARD() in the lookup definition, but I am now struggling with the search. I basically want the search to lookup each source file, then search the index and tell me what the latest time of the log is, as well as show a "No Logs Found" if source doesn't exist. I was toying with this, but the wildcards aren't working, and I think it is because I am not using the definition. But even so, I can't wrap my ahead around the search. | inputlookup pvs_source_list
| join type=left source
[| search index=pvs
| stats latest(_time) as TimeAx by source] Thank you!
... View more
Labels
- Labels:
-
lookup
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-17-2025
07:17 PM
|
